Working from the console#

You will end up able to do everything from a keyboard attached to the router that you would otherwise do from a browser — and several things you cannot do any other way. The console is the recovery path for a lockout, the only shell on a freshly installed box, and where an air-gapped router gets upgraded.

Before you start#

A monitor and keyboard, a serial connection, or a VM console.
The console password chosen during the install. It is the same for both console accounts.

Every boot writes /etc/issue, printed above the login prompt:

  Wheelhouse 0.5.1 -- edge
  ==========================================================================
  Web UI:    https://192.0.2.1:8443  (eth1)
  Sign in:   with your Wheelhouse admin account
  Console:   wheelhouse, with the password chosen at install
             vyos is kept for recovery
  --------------------------------------------------------------------------
  Built on VyOS wheelhouse-0.5.1
  Licences and source offer: /usr/share/doc/wheelhouse
  ==========================================================================

One Web UI: line per addressed interface, IPv4 first, up to five before it says how many more there are. Read it for three things:

"waiting for an address on any interface" — the machine has no address. Plug something in, or set one from the console.
A line saying the agent is not active — the agent is down and the line names the command to read its log.
Sign in: admin / <some string> — the agent bootstrapped a fresh account and that string is a one-time password, written to /config/wheelhouse/initial-password. Sign in with it and change it immediately; the file is deleted the moment that account's password changes.

The banner is redrawn from a timer, so it follows the machine: an address that arrives after boot appears without a reboot.

The two accounts, and which one you want#

Account	Is	Signs into
`wheelhouse`	The router's own shell and configuration account, from `system login user`. The one to use.	The console, and SSH if you turn it on
`vyos`	The same kind of account, kept for recovery. The installer gives it the same password and the same SSH keys as `wheelhouse`.	The console, and SSH
`admin`, and anyone you add	A Wheelhouse account, in the agent's own store	The web UI and the API

The first two are the base's accounts; the third is the product's. They are separate on purpose, and neither can be used in the other's place. Changing the web UI password does not change the console password, or the other way round.

On the live image, before an install, the console account is vyos with the password vyos, and the banner says so. A router installed by an older Wheelhouse has only vyos; the banner names whichever it finds.

Step 1 — Get a configuration session#

bash

configure

The prompt changes. From here set and delete behave exactly as every editor in the web UI shows them, because the UI stages the same lines.

set interfaces ethernet eth0 address 192.0.2.1/24
compare
commit
save

Four commands worth knowing before anything else:

Command	Does
`compare`	What committing would change, against what is running
`commit`	Apply. The running configuration changes; the boot configuration does not.
`save`	Write the running configuration to `/config/config.boot`, so it survives a reboot
`exit discard`	Leave the session and throw the changes away

commit without save is a change that disappears at the next reboot. The web UI's Commit Bar commits; saving to the boot configuration is a separate button on System → History, for exactly the same reason.

Step 2 — Commit something risky safely#

commit-confirm 2

Two minutes to run confirm. If you do not, the router reboots into the previous configuration. Use it for anything that touches uplink addressing, the firewall, NAT, SSH or the API — which is to say, anything that can end the session you are typing in, even at a physical console, because a firewall rule can strand the agent as readily as it can strand you.

What the console can do that the network cannot#

Recover a lockout. Locked out of the UI is almost entirely a console procedure.
Install an image from a local file, which the API cannot:
bash
```
add system image /path/to/wheelhouse-0.6.0-amd64.iso
```
The agent's image endpoint accepts http(s) URLs only, so an air-gapped router is upgraded here or not at all. Upgrade the whole system.
Commit nat static. The 1:1 NAT editor in the UI is switched off, because committing nat static through this platform build's HTTP API stops the API process. The CLI accepts the same lines. 1:1 NAT.
Run a packet capture. POST /api/capture is not implemented; it answers 501 and hands back the monitor traffic command to run here.
Read and edit the agent's store, with the agent stopped.

Step 3 — Run an operational command over SSH#

show configuration commands and its relatives are shell functions of the operational CLI, not programs, so a non-interactive SSH session needs the wrapper:

bash

ssh wheelhouse@<router> '/opt/vyatta/bin/vyatta-op-cmd-wrapper show configuration commands'

At an interactive console you just type show configuration commands.

Serial consoles#

The installer takes over the first video console (tty1) on a live boot. A serial console keeps a normal login prompt, and its banner says so. Log in as vyos and run the installer by hand:

bash

sudo wheelhouse-install

dialog draws in 80 columns; every installer screen and banner is sized for that.

Check it worked#

bash

show version
show interfaces
show configuration commands | wc -l

If show version answers, the router is alive regardless of what the network thinks.

Working from the console#

Before you start#

What the banner tells you#

The two accounts, and which one you want#

Step 1 — Get a configuration session#

Step 2 — Commit something risky safely#

What the console can do that the network cannot#

Step 3 — Run an operational command over SSH#

Serial consoles#

Check it worked#

See also#